Signaling fails when using trusts

[Thomas Herve]

When trying to signal a resource with trusts enabled, I get "Authorization failed: Expecting to find project, domain, or OS-TRUST:trust in scope." Full traceback at http://paste.openstack.org/show/72550/.

I'm using latest master at 9e60b408c178844ac54b0c83a8be1807f3c2854b, with latest devstack using domain user.

I created a heat_stack_owner role, and gave it to my user (admin/admin).

Using password deferred_auth_method works.

[Steven Hardy (shardy)]

This appears to be a keystoneclient regression:

https://github.com/openstack/python-keystoneclient/commit/7f1881211da4c22a718223af80645d5bfb609f3d

Everything works before that patch was merged but not afterwards, investigation in-progress as to why..

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/78224

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/78489

[Steven Hardy (shardy)]

As discussed in https://review.openstack.org/#/c/78224/1, there is actually a heat bug, we shouldn't pass project_name when creating a KeystoneClient object with a trust, fix in-progress

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/78562

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/78562
Committed: https://git.openstack.org/cgit/openstack/heat/commit/?id=3447a222bdac2782c06de958731dbafc3bc1e3c6
Submitter: Jenkins
Branch: master

commit 3447a222bdac2782c06de958731dbafc3bc1e3c6
Author: Steven Hardy <email address hidden>
Date: Thu Mar 6 09:52:39 2014 +0000

    heat_keystoneclient don't pass project and trust_id

    When creating a keystoneclient connection with a trust, we should
    not pass the project_name, as the token can only be scoped to either
    a trust or project, not both. Previous versions of keystoneclient
    worked with both, but recent changes mean this no longer works.

    Change-Id: I5c7e7498137d428360f2b5f1e8bd2d079c80cd9b
    Closes-Bug: #1288223

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/78489
Committed: https://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=d4892017f446ea2f9ae061058b79c1854bb91340
Submitter: Jenkins
Branch: master

commit d4892017f446ea2f9ae061058b79c1854bb91340
Author: Jamie Lennox <email address hidden>
Date: Thu Mar 6 10:58:51 2014 +1000

    Enforce scope mutual exclusion for trusts

    We already warn if you try to scope a domain and project together. This
    should be extended to trust scoping rather than clobbering the existing
    scope.

    Change-Id: I9d8fe001b65588b1c21e58f38a47456fdad85ee1
    Related-Bug: #1288223